FEDERAL BUREAU OF INVESTIGATION 



Precedence : ROUTINE 

To: General Counsel Attn: 



Date; . 00/00/201_ 

Steven N. Siegel 

Deputy General Counsel, NSLB 



[Counterintelligence/ 
Countert error i sm/ Cyber 3 



Attn: [UNIT] 



[REQUESTING OFFICE 3 Attn: 
[OFFICE OF ORIGIN] Attn: 



[DELIVERING DIVISION] Attn: 

(if using personal service) 



SSA [SQUAD SUPERVISOR] 
SA [CASE AGENT] 

SA [CASE AGENT] 
[SQUAD] [X] 

SSA [SQUAD SUPERVISOR] 
[SQUAD] [X] 



From: [DRAFTING DIVISION] 

[APPROVING OFFICIAL] 

Contact: [CASE AGENT, 000-000-0000] 



Approved By: 



Drafted By: 
Case ID #: (U) 
(TJ) Title: 



[ADIC NAME (IF APPLICABLE) ] 
[SAC NAME] 
[ASAC NAME] 
[CDC NAME] 
[SSA NAME] 

[LAST, FIRST, MIDDLE: INITIALS] 

[CASE FILE NUMBER] (Pending) 
[SUBJECT] 

[AKA] [ALIAS] (IF APPLICABLE)] 
[FCI/IT - FOREIGN POWER] 
[OO: OFFICE OF ORIGIN] 



Synopsis: (U) (NSLETR) Approves the issuance of an Electronic 
Communication Privacy Act (ECPA) National Security Letter 
(NSL)for electronic communications transactional records and 
subscriber information; provides reporting data; and transmits 
the NSL to the appropriate division for delivery to the 
electronic communications service provider. 



]4) (U) Derivec 
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To: General Counsel From: [DRAFTING DIVISION] 
Re: <U) [CASE FILE NUMBER], 00/00/201 



Declassily~Ott23^ifl ; ^^ on 
~ ~~ informatxon~~±Ti--fche EC]' 

(U) [Full/Preliminary] Investigation Initiated: [00/00/2008] 

Reference: (U) [CASE FILE NUMBER Serial XXX] 

Enclosure {s) : (U) Enclosed for [DELIVERING DIVISION or OFFICE 
OF ORIGIN, depending on whether service is personal or through 
restricted delivery service or fax] is an.NSL dated [00/00/2007], 
addressed to [COMPANY POC NAME], [TITLE, (if available)], 
[COMPANY NAME], [COMPANY ADDRESS - NO P.O. BOX], [CITY, STATE - 
NO ZIP CODE if using personal service], requesting the names, 
addresses, lengths of service, and electronic transactional 
records for the [e-mail/IP] address holder(s) listed. 

Details r ^fcg(f Brief explanat ion of why the NSL is being created 

(U) 
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A [FULL/PRELIMINARY] [FOREIGN COUNTERINTELLIGENCE/ 
INTERNATIONAL TERRORISM] investigation of subject, a [U.S. 
PERSON /NON-U . S . PERSON], was authorized in accordance with the 
Attorney General Guidelines because [Give a full explanation of 
the justification for opening and maintaining the investigation 
on the subject. Barebones facts will not suffice and will cause 
the request to be rejected for legal insufficiency] . These 
electronic communications transactional records are being 
requested to [Fully state the relevance of the requested records 
to the investigation] . 

(U) >t*rf Information is being sought on the following e- 

■ mail/IP address (es) [list the e-mail/IP address (es) or address 
holder (s) about which information is sought]. 

This electronic communication documents the 

[APPROVING OFFICIAL'S] approval and certification of the enclosed 
NSL. For mandatory reporting purposes, the enclosed NSL seeks 
electronic communication transactional records and subscriber 
information on [NUMBER OF] [e-mail/IP address (es)] from [ISP #1] ; 
[NUMBER OF] [e-mail/IP address (es) ] from [ISP #2] , etc. [In the 
case of multiple addresses to the same ISP, if you know how many 
different persons attach to those addresses, please state. 
Provide the USP status of all the persons about whom the requests 
are seeking information, including the subject of the 
investigation. In other words, do your best to give as much 
information as you can, for congressional reporting purposes.] 
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To: General Counsel From: [DRAFTING DIVISION] 
Re: (U) [CASE FILE NUMBER] , 00/00/201 



(U) Arrangements should be made with the electronic 
communications service provider to provide the records 
[personally to an employee of the DELIVERING division OR through 
use of a delivery service or secure fax to OFFICE OF ORIGIN] 
within [NUMBER OF] business days of receipt of this request. The 
electronic communications service provider should neither send 
the records through routine mail service nor utilize the name of 
the subject of the. request in any telephone calls to the FBI. 

[Certification and Activation of the Nondisclosure Requirement: • 
There is no longer an automatic prohibition that prevents the 
recipient of a National Security Letter from disclosing that the 
FBI has requested the information. To activate the nondisclosure 
requirement, the senior FBI official approving this' EC must use 
Option 1 below and include in the EC (but not in the NSL) a brief 
statement of facts that justify the nondisclosure requirement. 
Option 2 is to be used in all cases where Option 1 is not used.] 



DISCLOSURE PROVISIONS 



[Option 1 - Invoking Nondisclosure Requirement] 

(U) In accordance with 18 U.S.C. § 2709(c) I, the 
senior official approving this EC, certify that a disclosure of 
the fact that the FBI has sought or obtained access to the 
information sought by this letter may endanger the national 
security of the United States, interfere with a criminal, 
counterterrorism, or counterintelligence investigation, interfere 
with diplomatic relations, or endanger the life or physical safety 
of a person. 

""" ^Mj Brief statement of the facts justifying my 

certification in this case: 



[Option 2 - Declining to invoke the nondisclosure requirement] 

(U) I, the senior official approving this EC, have 
determined that the facts of this case do not warrant activation 
of the nondisclosure requirements under the applicable National 
Security Letter statute. 
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To: . General Counsel From: [DRAFTING DIVISION] 
Re: (U) [CASE FILE NUMBER] , 00/00/201_ 



[Include the next 2 paragraphs in all ECs.] 

(XJ) Information received from an electronic 
communications service provider may be disseminated in accordance 
with the FBI ' a Domestic Investigations and Operations Guide 
(DIOG) , and with. respect to dissemination to an agency of the 
United States, only if such information is clearly relevant to 
the authorized responsibilities of such agency. 

(TJ) Any questions regarding the above can be directed 
to [CASE AGENT, telephone number (000) 000-0000] . 
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To i General Counsel From: [DRAFTING DIVISION] 
Re; (D) [CASE PILE NUMBER]', O0/00/201_ 



LEAD (3) : 

Set Lead 1: (Action) 

GENERAL COUNSEL 

AT WASHINGTON. DC 

(U) NSLB is requested to record the appropriate 
information needed to fulfill the Congressional reporting 
requirements for NSLs. 

Set Lead 2: (Info) 

r COUNTERINTELLI GENCB / COUNTERTERRORI SM/ CYBER 1 

AT WASHINGTON, DC 

(U) At [UNIT] Read and Clear. 

Set Lead 3: (Action) 

[DELIVERING DIVISION - if using personal service! 

f AT CITY, STATE 1 

(U) Deliver the attached NSL as indicated .above. Upon 
receipt of information from the electronic communications service 
provider, [DELIVERING DIVISION] is requested to submit results to 
[DRAFTING DIVISION] and [OFFICE OF ORIGIN, if applicable] . 



JJfc&SST 
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U.S. Department of Justice 



Federal Bureau of Investigation 



Washington, D. C, 20535-00)1 

[DRAFTING DIVISION] 
[STREET ADDRESS] 
[CITY, STATE, ZIP CODE] 
[MONTH, DAY, YEAR] 

[MR. AIRS. /MS.] [COMPLETE NAME OF POC] 
[TITLE, IF AVAILABLE] 
[NAME OF COMPANY] 

[PHYSICAL STREET ADDRESS - NO P.O. BOX] 
[CITY, STATE - NO ZIP CODE] 

DEAR [MR. /MRS. /MS.] [LAST NAME] : 

Under the authority of Executive Order 12333, dated 
December 4, 1981, and pursuant to Title 18, United States Code 
(U.S.C.), Section 2709 (section 201 of the Electronic 
Communications Privacy Act, as amended) , you are hereby directed 
to provide the Federal Bureau of Investigation (FBI) the names, 
addresses, and length of service and electronic communications 
transactional records, to include existing transaction/ activity 
logs and all electronic mail (e-mail) header information, for the 
below-listed [e-mail/IP] address holder (s) : 

[E-mail/IP ADDRESS or ADDRESSES] 

[ON A SPECIFIC DATE] 

or 

[FOR THE PERIOD FROM [SPECIFIC DATE] TO [SPECIFIC DATE] 
or [PRESENT] ] 

Please see the attachment following this letter for 
the types of information that you might consider to be a 
electronic communications transactional record. We are not 
directing that you should provide, and you should not provide, 
information pursuant to this letter that would disclose the 
content of any electronic co mmun ication . Title 18 United States 
Code Section 2510(8) defines content as "any information 
concerning the substance, purport, or meaning of a 
communication. Subject lines of e-mails and message content are 
content information and should not be provided pursuant to this 
letter . 

If the time period noted above is to the "present," 
that term is intended to direct production of information to the 
date of the processing of this letter. If providing information 
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to the date of processing is not feasible, please provide 
information to the date of receipt of this letter. 

While fulfilling your obligations under this letter, 
please do not disable, suspend, lock, cancel or interrupt service 
to the above -described subscriber (s) or accounts. A service 
interruption or degradation may alert the subscriber (s) /account 
users (s) that investigative action is being taken. If you are not 
able to fulfill your obligations under this letter without 
alerting, the subscriber/account user, please contact the FBI 
prior to proceeding. 

In accordance with Title 18, U.S.C., Section 2709(b), I 
certify that the information sought is relevant to an authorized 
investigation to protect against international terrorism or 
clandestine intelligence activities, and that such an 
investigation of a United States person is not conducted solely 
on the basis of activities protected by the First Amendment to 
the Constitution of the United States. 

[Certification: The nondisclosure requirement is not an automatic 
feature of the NSL. If the supporting EC for this NSL included 
Option 1 (Invoking the Nondisclosure Requirement) , then include 
the language in the following 3 paragraphs in the NSL. ] 

In accordance with 18 U.S.C. § 2709(c)(1), I certify 
that a disclosure of the fact that the FBI has sought or obtained 
access to the information sought by this letter may endanger the 
national security of the United States, interfere with a 
criminal, counterterrorisra, or counterintelligence investigation, 
interfere with diplomatic relations, or endanger the life or 
physical safety of a person. Accordingly, 18 U.S.C. § 2709(c)(1) 
and (2) prohibits you, or any officer, employee, or agent of 
yours, from disclosing this letter, other than to those to whom 
disclosure is necessary to comply with the letter or to an 
attorney to obtain legal advice or legal assistance with respect 
to this letter.. 

In accordance with 18 U.S.C. § 2709(c) (3), you are 
directed to notify any persons to whom you have disclosed this 
letter that they are also subject to the nondisclosure 
requirement and are therefore also prohibited from disclosing the 
letter to anyone else. 

In accordance with 18 U.S.C. § 2709(c) (4), if the FBI 
asks for the information, you should identify any person to whom 
such disclosure has been made or to whom such disclosure will be 
made. In no instance will you be required to identify any 
attorney to whom disclosure was made or will be made in order to 
obtain legal advice or legal assistance with respect to this 
letter. 
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[Include the following language in all NSLs . ] 

In accordance with 18 U.S.C. § 3511(a) and (b)(1), you 
have a right to challenge this letter if compliance would be 
unreasonable, oppressive, or otherwise unlawful. 

You also have the right to challenge the nondisclosure 
requirement set forth above. If you wish to make a disclosure 
that Is prohibited by the nondisclosure requirement, you must 
notify the .FBI, in writing, of your desire to do so within 10 
calendar days of receipt of this letter. That notice must be 
mailed or faxed to [the XXXX] Division, attention: CASE AGENT 
(phone number: xxxx) , with a copy to FBI HQ, attention: General 
Counsel (fax number: 202-324-5366) and must reference the date of 
the NSL and the identification number on the upper left corner of 
the NSL. If you send notice within 10 calendar dayB, the FBI 
will initiate judicial proceedings in approximately 30 days in 
order to demonstrate to a federal judge the need for 
nondisclosure and to obtain a judicial order requiring continued 
nondisclosure. The nondisclosure requirement will remain in 
effect unless and until there is a final court order holding that 
disclosure is permitted. 

If you do not send notice of your desire to disclose 
the NSL or the fact that you produced records in response to it 
within 10 calendar days of receipt, then the .nondisclosure 
provision will remain in effect, subject to your opportunity to 
make an annual challenge to the nondisclosure requirement as 
provided by subsection 3511(b) . 

In accordance with 18 U.S.C. § 3511(c), an unlawful 
failure to comply with this letter, including any nondisclosure 
requirement, may result in the United States bringing an 
enforcement action. 

You are directed to provide records responsive to this 
letter [personally to a representative of the [DELIVERING 
DIVISION] OR through use of a delivery service to {OFFICE OF 
ORIGIN] OR through secure fax] within [xxxx] business days of 
receipt of this letter. 

Any questions you have regarding this letter should be 
directed only to the [ [DELIVERING DIVISION] OR [OFFICE OF 
ORIGIN] , _depending on whether service is personal or through a 
delivery service] . Due to security considerations/ you should 
neither send the records through routine mail service nor non- 
secure fax, nor disclose the substance of this letter in any 
telephone conversation. 

Your cooperation in this matter is greatly- appreciated. 



3 



ACLU-NSL-332 



Sincerely, 
[ADIC/SAC NAME] 

[ASSISTANT DIRECTOR IN CHARGE/ 
SPECIAL AGENT IN CHARGE] 
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ATTACHMENT 



In preparing your response to this National Security Letter, you 
should determine whether your company maintains the following 
types of information which may be considered by you to be an 
electronic communications transactional record in accordance with 
Title 18 United States Code Section 2709. 



* 
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We are not directing that you should provide, and you should not 
provide, information pursuant to this letter that would disclose 
the content of any electronic communication. Title 18 United 
States Code Section 2510 (8) defines content as "any information 
concerning the substance, purport, or meaning of" a 
communication. Subject lines of e-mails axe content information 
and should not be provided pursuant to this letter. If the 
records provided are particularly large we request that you 
provide this information in electronic format, preferably on a 
CD -ROM. 
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